{"id":"CVE-2023-3452","aliases":["EUVD-2023-44114","GHSA-r7j9-2qv5-fpm9"],"status":"published","title":"Canto \u003c= 3.0.4 - Unauthenticated Remote File Inclusion","description":"The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.06958,"percentile":0.94166,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-98"],"published":"2023-08-12T02:05:19Z","modified":"2026-06-17T06:14:06Z","exploits":[{"source":"nuclei","id":"CVE-2023-3452","title":"WordPress Canto Plugin \u003c= 3.0.4 - File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3452.yaml"},{"source":"pocgithub","id":"Alpastx/CVE-2023-3452---WordPress-Canto-Plugin-RCE","title":"Alpastx/CVE-2023-3452---WordPress-Canto-Plugin-RCE","date":"2026-03-03","url":"https://github.com/Alpastx/CVE-2023-3452---WordPress-Canto-Plugin-RCE"},{"source":"pocgithub","id":"leoanggal1/CVE-2023-3452-PoC","title":"leoanggal1/CVE-2023-3452-PoC","date":"2023-11-05","url":"https://github.com/leoanggal1/CVE-2023-3452-PoC"},{"source":"pocgithub","id":"puppetma4ster/Metasploit-Wordpress-Canto-Exploit-RCE","title":"puppetma4ster/Metasploit-Wordpress-Canto-Exploit-RCE","date":"2026-03-06","url":"https://github.com/puppetma4ster/Metasploit-Wordpress-Canto-Exploit-RCE"}],"products":[{"vendor":"canto","product":"canto"},{"vendor":"flightbycanto","product":"canto"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a76077c6-700a-4d21-a930-b0d6455d959c?source=cve","tags":["x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/tree.php?rev=2841358#L5","tags":["x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/2951888/canto/trunk/includes/lib/tree.php","tags":["x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3452"},{"url":"https://github.com/advisories/GHSA-r7j9-2qv5-fpm9"}],"sources":{"cve":[{"id":"CVE-2023-3452","title":"Canto \u003c= 3.0.4 - Unauthenticated Remote File Inclusion","description":"The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.","status":"published","published":"2023-08-12T02:05:19.117Z","modified":"2026-04-08T17:13:38.027Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:35:24.360381Z"}],"euvd":[{"id":"EUVD-2023-44114","description":"The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.","status":"published","published":"2023-08-12T02:05:19Z","modified":"2026-04-08T17:13:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:46.295439Z"}],"ghsa":[{"id":"GHSA-r7j9-2qv5-fpm9","title":"The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and...","description":"The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.","status":"published","published":"2023-08-12T03:30:18Z","modified":"2024-04-04T06:53:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:56:46.449942Z"}],"nvd":[{"id":"CVE-2023-3452","description":"The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.","status":"published","published":"2023-08-12T03:15:09.33Z","modified":"2026-06-17T06:14:06.147Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:08:22.812138Z"}]}}